Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.

Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/1aa56c256936f433f6e9393e844b33fda6bd7bec (Reland "chromeos: Enable SingleProcessMash (in-proc window service) by default").

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.

I think this is due to hitting escape twice with the window selection filter text field open.

windowactivate --sync 6291460
mousemove_relative --sync -- 189 53
mouseup -- 1
type -- 'Ug2NR\yt'
keydown -- space
mousedown -- 1
mousemove -- 504 906
mousedown -- 1
mousemove_relative -- 0 1
mousemove_relative -- 0 -
mousemove -- 658 413
mouseup -- 1
click --repeat 1 -- 1
key -- F1
click --repeat 1 -- 3
click --repeat 3 -- 1
key -- F5                   ### Opens overview.
type -- 'OB3kPJEqRo%k'      ### Makes text field appear.
key -- 0
key -- Right V
keydown -- space
key -- Escape space Tab BackSpace h Escape  ### Closes overview, maybe twice
mousemove -- 574 115
mousedown -- 1
mousemove_relative -- 0 1
mousemove_relative -- 0 -
mousemove -- 904 44
mouseup -- 1
key -- meta+G
mouseup -- 4
click --repeat 2 -- 1
type -- 'sOXON~4%#\'
keyup -- 7
key -- ctrl+minus
key -- c
mousemove_relative --sync -- 24 12
mousemove -- 610 318
mousedown -- 1
mousemove_relative -- 0 1
mousemove_relative -- 0 -
mousemove -- 861 756
mouseup -- 1

Better stack:

==3005218==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000070 (pc 0x5569520ff850 bp 0x7ffdeae36e90 sp 0x7ffdeae36e60 T0)
==3005218==The signal is caused by a READ memory access.
==3005218==Hint: address points to the zero page.
SCARINESS: 10 (null-deref)
    #0 0x5569520ff84f in end buildtools/third_party/libc++/trunk/include/vector:1522:30
    #1 0x5569520ff84f in ash::WindowSelector::UpdateMaskAndShadow(bool) ash/wm/overview/window_selector.cc:758
     #2 0x556951d1299e in ash::WindowSelectorController::OnSelectionEnded() ash/wm/overview/window_selector_controller.cc:524:21
    #3 0x5569521021e0 in CancelSelection ash/wm/overview/window_selector.cc:477:14
     #4 0x5569521021e0 in ash::WindowSelector::HandleKeyEvent(views::Textfield*, ui::KeyEvent const&) ash/wm/overview/window_selector.cc:947
     #5 0x55694f13b99a in views::Textfield::OnKeyPressed(ui::KeyEvent const&) ui/views/controls/textfield/textfield.cc:724:46
    #6 0x55694f1a8234 in OnKeyEvent ui/views/view.cc:996:59
    #7 0x55694f1a8234 in non-virtual thunk to views::View::OnKeyEvent(ui::KeyEvent*) ui/views/view.cc:0
    #8 0x55694b507837 in DispatchEvent ui/events/event_dispatcher.cc:193:12
    #9 0x55694b507837 in ui::EventDispatcher::ProcessEvent(ui::EventTarget*, ui::Event*) ui/events/event_dispatcher.cc:142
    #10 0x55694b506e86 in ui::EventDispatcherDelegate::DispatchEventToTarget(ui::EventTarget*, ui::Event*) ui/events/event_dispatcher.cc:86:14
    #11 0x55694b506b57 in ui::EventDispatcherDelegate::DispatchEvent(ui::EventTarget*, ui::Event*) ui/events/event_dispatcher.cc:58:15
    #12 0x556957d9017a in ui::EventProcessor::OnEventFromSource(ui::Event*) ui/events/event_processor.cc:57:17
...

It looks like WindowSelectorController::window_selector_ can be null sometimes.

ClusterFuzz has detected this issue as fixed in range 622229:622235.

Detailed report: https://clusterfuzz.com/testcase?key=5180342818045952

Fuzzer: noel-image-surku
Job Type: linux_asan_chrome_chromeos
Platform Id: linux

Crash Type: Null-dereference READ
Crash Address: 0x000000000070
Crash State:
  ash::WindowSelectorController::OnSelectionEnded
  ash::WindowSelector::HandleKeyEvent
  views::Textfield::OnKeyPressed
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_asan_chrome_chromeos&range=621155:621156
Fixed: https://clusterfuzz.com/revisions?job=linux_asan_chrome_chromeos&range=622229:622235

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5180342818045952

Additional requirements: Requires Gestures

See https://github.com/google/clusterfuzz-tools for instructions to reproduce this bug locally.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 5180342818045952 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Not really fixed, that CL range just disabled SingleProcessMash by default.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/431a0293d59fc23e464428ba5f837c7e31855ca1

commit 431a0293d59fc23e464428ba5f837c7e31855ca1
Author: James Cook <jamescook@chromium.org>
Date: Mon Jan 14 17:37:59 2019

Fix clusterfuzz crash exiting overview mode with 2 escape key presses

The clusterfuzz sequence presses F5 (which enters overview mode),
types some garbage (which brings up the text filter), then does a
key press sequence that includes 2 escape presses.

I think WindowSelectorController::OnSelectionEnded() is called twice.
The second time the |window_selector_| is null, so there's a null
pointer reference on window_selector_->UpdateMaskAndShadow().

I can't reproduce this locally, either manually or with the clusterfuzz
test case. However, I wrote a test that reproduces the clusterfuzz call
stack.

Bug:  920568 , 912623
Test: ash_unittests
Change-Id: I2dae1e5fca56f9c34d37a3c605fd231e27d95763
Reviewed-on: https://chromium-review.googlesource.com/c/1405283
Commit-Queue: James Cook <jamescook@chromium.org>
Reviewed-by: Mitsuru Oshima <oshima@chromium.org>
Cr-Commit-Position: refs/heads/master@{#622498}
[modify] https://crrev.com/431a0293d59fc23e464428ba5f837c7e31855ca1/ash/wm/overview/window_selector_controller.cc
[modify] https://crrev.com/431a0293d59fc23e464428ba5f837c7e31855ca1/ash/wm/overview/window_selector_unittest.cc

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/9d03e16743fa5f4482c678d510093b992b2fa4da

commit 9d03e16743fa5f4482c678d510093b992b2fa4da
Author: James Cook <jamescook@chromium.org>
Date: Tue Jan 15 23:49:01 2019

chromeos: Clean up overview mode shutdown code

Eliminate WindowSelectorController::is_shutting_down_. Pass around
explicit WindowSelector* pointers when ending overview mode, to
make it clear that it cannot be null.

Reset WindowGrid's cached window_selector_ pointer during shutdown,
since that object is about to be deleted.

The lifetimes of these objects are very complex, but hopefully this
makes things a little clearer.

Bug:  920568 , 881089
Test: ash_unittests, manually tested overview mode and tablet mode
in an ASAN build

Change-Id: Ia74b9b2417a31ddc8071611f6103bfcf0f81c6b6
Reviewed-on: https://chromium-review.googlesource.com/c/1406169
Commit-Queue: James Cook <jamescook@chromium.org>
Reviewed-by: Mitsuru Oshima <oshima@chromium.org>
Cr-Commit-Position: refs/heads/master@{#622874}
[modify] https://crrev.com/9d03e16743fa5f4482c678d510093b992b2fa4da/ash/app_list/app_list_controller_impl.cc
[modify] https://crrev.com/9d03e16743fa5f4482c678d510093b992b2fa4da/ash/app_list/app_list_controller_impl.h
[modify] https://crrev.com/9d03e16743fa5f4482c678d510093b992b2fa4da/ash/frame/wide_frame_view.cc
[modify] https://crrev.com/9d03e16743fa5f4482c678d510093b992b2fa4da/ash/shell.cc
[modify] https://crrev.com/9d03e16743fa5f4482c678d510093b992b2fa4da/ash/shell.h
[modify] https://crrev.com/9d03e16743fa5f4482c678d510093b992b2fa4da/ash/shell_observer.h
[modify] https://crrev.com/9d03e16743fa5f4482c678d510093b992b2fa4da/ash/wm/overview/window_grid.cc
[modify] https://crrev.com/9d03e16743fa5f4482c678d510093b992b2fa4da/ash/wm/overview/window_selector.cc
[modify] https://crrev.com/9d03e16743fa5f4482c678d510093b992b2fa4da/ash/wm/overview/window_selector.h
[modify] https://crrev.com/9d03e16743fa5f4482c678d510093b992b2fa4da/ash/wm/overview/window_selector_controller.cc
[modify] https://crrev.com/9d03e16743fa5f4482c678d510093b992b2fa4da/ash/wm/overview/window_selector_controller.h
[modify] https://crrev.com/9d03e16743fa5f4482c678d510093b992b2fa4da/ash/wm/overview/window_selector_controller_unittest.cc
[modify] https://crrev.com/9d03e16743fa5f4482c678d510093b992b2fa4da/ash/wm/splitview/split_view_controller.cc
[modify] https://crrev.com/9d03e16743fa5f4482c678d510093b992b2fa4da/ash/wm/splitview/split_view_controller.h
[modify] https://crrev.com/9d03e16743fa5f4482c678d510093b992b2fa4da/ash/wm/splitview/split_view_controller_unittest.cc
[modify] https://crrev.com/9d03e16743fa5f4482c678d510093b992b2fa4da/ash/wm/tablet_mode/tablet_mode_window_manager.cc
[modify] https://crrev.com/9d03e16743fa5f4482c678d510093b992b2fa4da/ash/wm/tablet_mode/tablet_mode_window_manager.h
[modify] https://crrev.com/9d03e16743fa5f4482c678d510093b992b2fa4da/ash/wm/wm_shadow_controller_delegate.cc
[modify] https://crrev.com/9d03e16743fa5f4482c678d510093b992b2fa4da/ash/wm/workspace/backdrop_controller.cc
[modify] https://crrev.com/9d03e16743fa5f4482c678d510093b992b2fa4da/ash/wm/workspace/backdrop_controller.h